npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-3C7F-5HGJ-H279Mediumn8n: n8n has XSS in Chat Trigger Node through Custom CSS GHSA-W673-8FJW-457CMediumn8n: n8n: Authenticated XSS and Open Redirect via Form Node CVE-2026-56358Mediumn8n: n8n has a Stored XSS Vulnerability in its Form Trigger CVE-2026-33994Mediumlocutus: Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 CVE-2026-33993Mediumlocutus: Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()CVE-2026-33979Highexpress-xss-sanitizer: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)GHSA-89V5-38XR-9M4JHighpostiz: Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader GHSA-VJ2P-7PGW-G2WFHighpostiz: Postiz App has a High-Severity SSRF Vulnerability via Next.js GHSA-C7W3-X93F-QMM8Lownodemailer: Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter CVE-2026-33943Highhappy-dom: Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVE-2026-33916Mediumhandlebars: Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection CVE-2026-33896Highnode-forge: Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33895Highnode-forge: Forge has signature forgery in Ed25519 due to missing S > L check CVE-2026-33894Highnode-forge: Forge has signature forgery in RSA-PKCS due to ASN.1 extra field CVE-2026-33891Highnode-forge: Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input GHSA-9Q82-XGWF-VJ6HMedium@apollo/server: Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention CVE-2026-35632Mediumopenclaw: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)CVE-2026-35658Mediumopenclaw: OpenClaw: Image Tool `tools.fs.workspaceOnly` Bypass via Sandbox Bridge Mounts CVE-2026-35655Mediumopenclaw: OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting CVE-2026-35635Mediumopenclaw: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision CVE-2026-35662Mediumopenclaw: OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions CVE-2026-35656Mediumopenclaw: OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection CVE-2026-35639Criticalopenclaw: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve CVE-2026-35622Mediumopenclaw: OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals CVE-2026-35624Lowopenclaw: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.